Sole Global Administrator locked out — MFA SMS blocked (Error 399287)

Contact Microsoft 365 business phone support and request a tenant-lockout recovery case with the Microsoft 365 Data Protection team; after ownership verification, Microsoft can restore access to the existing tenant and, where confirmed, remove the backend SMS reputation block.

Open the recovery case

1. Use Microsoft’s regional work-account/business support phone list and select the number for your country or region ^1^.
2. Describe the case as:
   • Microsoft 365 for business
   • Sole Global Administrator locked out
   • Password is known
   • Microsoft Authenticator is unavailable
   • SMS MFA fails immediately with error 399287
   • No other Global Administrator can reset the authentication methods
3. Ask the frontline agent to:
   • Open a tenant lockout/account recovery service request.
   • Route it to the Microsoft 365 Data Protection team.
   • Record that backend SMS/MFA review is required.
4. Have these details ready, but provide them only through the support case or another private Microsoft channel:
   • Tenant’s initial onmicrosoft.com domain
   • Locked administrator’s user principal name
   • Tenant ID, if known
   • Registered phone number, country code, and country
   • Error code 399287
   • Request ID, correlation ID, and UTC timestamp from the failed sign-in
   • Subscription, billing, domain/DNS, or other records requested to prove tenant ownership

Microsoft documents that when a tenant is locked out, support performs high-assurance identity verification and helps a designated Global Administrator regain access to the existing tenant ^2^. Phone support is the appropriate route when portals are inaccessible.

A closely matching accepted Q&A case—sole administrator, unavailable Authenticator, SMS error 399287, and no alternate administrator—was resolved after private details were collected and engineering removed the backend bad-reputation block ^3^. That outcome supports requesting this review, but support must first confirm that the same backend condition applies to your number.

Suggested wording

I am the sole Global Administrator of a Microsoft 365 business tenant and cannot access the admin center. My password is accepted, Microsoft Authenticator is unavailable, and SMS MFA immediately fails with error 399287. No alternate authentication method or other Global Administrator is available. Please open a tenant-lockout recovery case, route it to the Microsoft 365 Data Protection team, and request backend review of the SMS/MFA block. I can provide ownership and sign-in diagnostic details privately.

Microsoft phone support uses account-verification controls, so call with the organization’s registered contact information available. If calling from an unregistered number, the representative may attempt to send a PIN to contact details stored in the organization profile ^4^. Explain immediately if that verification destination is itself inaccessible.

Conditional alternatives

• If the tenant was purchased through a CSP/reseller: ask the provider whether it has an active GDAP relationship and an appropriate role. A partner with sufficient access can restore access directly or open a Microsoft service request on your behalf ^5^.
• If phone routing fails: use Microsoft’s public support flow, enter the issue, select Get Help, and then Contact Support when offered [^6^](https://support.microsoft.com/accounts-billing/subscriptions/[Subscription ID] "Microsoft 365 for business"). Because you cannot enter the tenant portal, phone support or a reseller-opened case remains the more direct route.
• Avoid repeated SMS attempts while waiting. Microsoft notes that a high volume of verification requests can itself cause or prolong a block ^7^.

After access is restored

Immediately register more than one independent authentication method and add administrative redundancy. Microsoft recommends at least two Global Administrator accounts with distinct credentials and MFA methods, plus emergency-access planning ^5^. Review and add methods under My Profile → security/verification methods ^8^.

References

1. [Personal account](https://support.microsoft.com/support/#microsoft-sales-support)
2. Plan for tenant recoverability
3. Locked out as sole Global Admin — MFA Error 399287, phone reputation block - Microsoft Q&A
4. Get support for Microsoft 365 for business
5. Preventing tenant lockouts
6. [Microsoft 365 for business](https://support.microsoft.com/accounts-billing/subscriptions/[Subscription ID])
7. Troubleshoot Microsoft verification code issues | Microsoft Support
8. Set up multifactor authentication for your Microsoft 365 account | Microsoft Support